RE: VPN
"Tom Curbishley" <[email protected]> Tue, 4 Feb 2003 09:34:54 -0500
| Newsgroups | gmane.linux.linux-router |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. ------=_NextPart_000_004F_01C2CC30.B2A50190 Content-Type: text/plain; charset="US-ASCII" Content-Transfer-Encoding: 7bit Hello Marcus, Which version of LRP? I've just upgraded to the Bering distro and it is marvelously simple to set up and easier to understand than the previous EigerStein LRP that I had installed. Bering is based on Charlie Steinkuhler's Dachstein LRP lrp.steinkuehler.net <http://lrp.steinkuehler.net/> (If you have not already done so, I would encourage you to investigate Bering or its contemporaries at leaf.sourceforge.net <http://leaf.sourceforge.net/> .) Anyway, I had a similar setup. In my case I have a Win2K server hosting VPN connections sitting behind my Bering firewall. The firewall is set up to masq our single static IP address. In order to allow clients from the Internet to establish a PPTP VPN tunnel to the inside host, you have to route TCP port 1723 and protocol 47 (something called GRE). Note that GRE is a protocol and not a port. Bering uses a package called Shorewall to manage iptables rules. For this package you might add the following rules: DNAT net loc:x.x.x.x tcp 1723 DNAT net loc:x.x.x.x 47 This would allow anyone on the Internet who could authenticate against your server to establish a PPTP VPN tunnel. I just tried this last night and it worked like a charm. You could also restrict the rule to specific source addresses for added security. I also tried to allow L2TP VPN connections, but there's some stuff about certificates that I need to learn. For L2TP you need to open port 500/udp (IPsec), protocols 50 and 51 (ESP and AH) and port 1701/udp. For Bering/Shorewall my guess is that these commands would do it: DNAT net loc:x.x.x.x udp 500 #IPsec DNAT net loc:x.x.x.x 50 #ESP - Tunnel mode DNAT net loc:x.x.x.x 51 #AH - Transport mode DNAT net loc:x.x.x.x udp 1701 #L2TP I tried this last night too, but as I indicated above, the client complained about certificates. I guess I have more reading to do. You might have a look at http://mccammon.org/articles/vpn_faq.php. I found it very helpful. Hope this helps, Tom Curbishley Ewing, NJ USA -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Marcus Steeneken Sent: Sunday, February 02, 2003 6:11 PM To: [email protected] Subject: [LRP] VPN I am using the LRP and would like to setup a PPTP serving inside the firewall, but can't find any good info on how to do this. Can anyone help me please? ------=_NextPart_000_004F_01C2CC30.B2A50190 Content-Type: text/html; charset="US-ASCII" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <meta name=3DGenerator content=3D"Microsoft Word 10 (filtered)"> <style> <!-- /* Font Definitions */ @font-face {font-family:Tahoma; panose-1:2 11 6 4 3 5 4 4 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman";} a:link, span.MsoHyperlink {color:blue; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {color:purple; text-decoration:underline;} span.EmailStyle17 {font-family:Arial; color:navy;} @page Section1 {size:8.5in 11.0in; margin:1.0in 1.25in 1.0in 1.25in;} div.Section1 {page:Section1;} --> </style> </head> <body bgcolor=3Dwhite lang=3DEN-US link=3Dblue vlink=3Dpurple> <div class=3DSection1> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Hello Marcus,</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Which version of LRP? I’ve = just upgraded to the Bering distro and it is marvelously simple to set up and = easier to understand than the previous EigerStein LRP that I had installed. = Bering is based on Charlie Steinkuhler’s Dachstein LRP </span></font><font = size=3D2 face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'><a href=3D"http://lrp.steinkuehler.net/">lrp.steinkuehler.net</a></span></fo= nt> <font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial; color:navy'> (If you have not already done so, I would encourage = you to investigate Bering or its contemporaries at <a href=3D"http://leaf.sourceforge.net/">leaf.sourceforge.net</a>.)</span></= font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Anyway, I had a similar setup. In = my case I have a Win2K server hosting VPN connections sitting behind my Bering = firewall. The firewall is set up to masq our single static IP address. In order to = allow clients from the Internet to establish a PPTP VPN tunnel to the inside = host, you have to route TCP port 1723 and protocol 47 (something called GRE). = Note that GRE is a protocol and not a port.</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Bering uses a package called = Shorewall to manage iptables rules. For this package you might add the following = rules:</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>DNAT = net = loc:x.x.x.x = tcp 1723</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>DNAT = net = loc:x.x.x.x = 47</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>This would allow anyone on the = Internet who could authenticate against your server to establish a PPTP VPN = tunnel. I just tried this last night and it worked like a charm. You could also = restrict the rule to specific source addresses for added = security.</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>I also tried to allow L2TP VPN connections, but there’s some stuff about certificates that I need = to learn. For L2TP you need to open port 500/udp (IPsec), protocols 50 and = 51 (ESP and AH) and port 1701/udp. For Bering/Shorewall my guess is that these = commands would do it:</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>DNAT = net = loc:x.x.x.x = udp = 500 #IPsec</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>DNAT = net = loc:x.x.x.x = 50  = ; #ESP – Tunnel mode</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>DNAT = net = loc:x.x.x.x = 51  = ; #AH – Transport mode</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>DNAT = net = loc:x.x.x.x = udp 1701 = #L2TP</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>I tried this last night too, but as = I indicated above, the client complained about certificates. I guess I = have more reading to do. You might have a look at <a href=3D"http://mccammon.org/articles/vpn_faq.php">http://mccammon.org/art= icles/vpn_faq.php</a>. I found it very helpful.</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Hope this helps,</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Tom Curbishley</span></font></p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'>Ewing</span></font><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial; color:navy'>, </span></font><font size=3D2 color=3Dnavy = face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial;color:navy'>NJ</span></font><= font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial; color:navy'> </span></font><font size=3D2 color=3Dnavy = face=3DArial><span = style=3D'font-size:10.0pt;font-family:Arial;color:navy'>USA</span></font>= </p> <p class=3DMsoNormal><font size=3D2 color=3Dnavy face=3DArial><span = style=3D'font-size: 10.0pt;font-family:Arial;color:navy'> </span></font></p> <p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D2 = face=3DTahoma><span style=3D'font-size:10.0pt;font-family:Tahoma'>-----Original = Message-----<br> <b><span style=3D'font-weight:bold'>From:</span></b> = [email protected] [mailto:[email protected]] <b><span = style=3D'font-weight:bold'>On Behalf Of </span></b>Marcus Steeneken<br> <b><span style=3D'font-weight:bold'>Sent:</span></b> </span></font><font = size=3D2 face=3DTahoma><span = style=3D'font-size:10.0pt;font-family:Tahoma'>Sunday, February 02, 2003</span></font><font size=3D2 face=3DTahoma><span style=3D'font-size:10.0pt;font-family:Tahoma'> </span></font><font size=3D2 face=3DTahoma><span = style=3D'font-size:10.0pt;font-family:Tahoma'>6:11 PM</span></font><font size=3D2 face=3DTahoma><span = style=3D'font-size:10.0pt;font-family:Tahoma'><br> <b><span style=3D'font-weight:bold'>To:</span></b> = [email protected]<br> <b><span style=3D'font-weight:bold'>Subject:</span></b> [LRP] = VPN</span></font></p> <p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D3 = face=3D"Times New Roman"><span style=3D'font-size:12.0pt'> </span></font></p> <div> <p class=3DMsoNormal style=3D'margin-left:.5in'><font size=3D2 = face=3DArial><span style=3D'font-size:10.0pt;font-family:Arial'>I am using the LRP and = would like to setup a PPTP serving inside the firewall, but can't find any good info = on how to do this. Can anyone help me please?</span></font></p> </div> </div> </body> </html> ------=_NextPart_000_004F_01C2CC30.B2A50190-- _______________________________________________ linux-router maillist - [email protected] http://www.linuxrouter.org/mailman/listinfo/linux-router